Last updated
Monitors the network and applications by sniffing packets
$ winget install --id Elastic.Packetbeat --exact --version 9.4.4Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.
Beats packetbeat uses MSI (WiX). The silent install switches are /quiet /norestart.
msiexec.exe /i packetbeat-9.4.4-windows-x86_64.msi /quiet /norestart
See the full silent install reference for Beats packetbeat →
For IT teams
App deployment, patching, and remote support in one place. Push this app to every device you manage, keep it patched automatically, and see new CVEs the moment they land. Works with Intune or fully standalone.
Sign up freeFree for up to 5 devices.
Packetbeat is an open source network packet analyzer that ships the data to Elasticsearch. Think of it like a distributed real-time Wireshark with a lot more analytics features.
The Packetbeat shippers sniff the traffic between your application processes, parse on the fly protocols like HTTP, MySQL, PostgreSQL, Redis or Thrift and correlate the messages into transactions.
For each transaction, the shipper inserts a JSON document into Elasticsearch, where it is stored and indexed. You can then use Kibana to view key metrics and do ad-hoc queries against the data.
| Architecture | Type | Scope | Install | Download |
|---|---|---|---|---|
| x64 | MSI WiX | machine | Direct |
Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.
5 known CVEs via NVD
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interfac...
Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. Thi...
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat.
Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service (DoS) through a reliable process crash when handling truncated XDR-encoded RPC messages.
Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number.
See a CVE that affects your fleet? Pckgr RMM flags vulnerable devices and pushes the patched version automatically - automated patching is the only way to keep up.
More from Elastic.